{"affected":[{"defaultStatus":"unaffected","product":"WPeMatico RSS Feed Fetcher","source":"CNA: Wordfence","vendor":"etruel","versions":[{"lessThanOrEqual":"2.9.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120573","cwes":["CWE-79"],"description":"The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen.","epss":{"date":"2026-11-13","percentile":0.2976,"score":0.00356},"exploits":[],"kev":null,"metrics":[{"score":6.4,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},{"score":6.4,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794598168348,"publishedAt":1794562515899,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaigns_list.php#L820"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/wpematico_functions.php#L1106"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaign_edit.php#L540"},{"source":"CNA: Wordfence","tags":[],"url":"https://github.com/etruel/wpematico/tree/2.9.2"},{"source":"security@wordfence.com","tags":[],"url":"https://github.com/etruel/wpematico/tree/2.9.2"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaign_edit.php#L540"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaigns_list.php#L820"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/wpematico_functions.php#L1106"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=cve"}],"remediation":[],"revision":"d63d356175b86fdc30d3528b086909c8fd29042ad483cf53b923b532d8cfd4ed","sources":[{"modifiedAt":1794598168348,"name":"CNA: Wordfence","retrievedAt":1794600527121,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120573"},{"modifiedAt":1794565046947,"name":"NVD","retrievedAt":1794572163446,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120573"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794600531714,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-120573"}],"ssvc":{"assessedAt":1794598159052,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter","updatedAt":1794600531714}